{"record":{"id":"513ab5ac85aa2829","repo":"nextauthjs/next-auth","slug":"data-message-513ab5","errorCode":null,"errorMessage":"data.message","messagePattern":"data\\.message","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/frameworks-sveltekit/src/lib/actions.ts","lineNumber":147,"sourceCode":"  )\n  const request = new Request(sessionUrl, {\n    headers: { cookie: req.headers.get(\"cookie\") ?? \"\" },\n  })\n  const response = await Auth(request, config)\n\n  const authCookies = parse(response.headers.getSetCookie())\n  for (const cookie of authCookies) {\n    const { name, value, ...options } = cookie\n    // @ts-expect-error - Review: SvelteKit and set-cookie-parser are mismatching\n    event.cookies.set(name, value, { path: \"/\", ...options })\n  }\n\n  const { status = 200 } = response\n  const data = await response.json()\n\n  if (!data || !Object.keys(data).length) return null\n  if (status === 200) return data\n  throw new Error(data.message)\n}\n","sourceCodeStart":129,"sourceCodeEnd":149,"githubUrl":"https://github.com/nextauthjs/next-auth/blob/a1a16a5a7780488c7449feece410033f445d0b31/packages/frameworks-sveltekit/src/lib/actions.ts#L129-L149","documentation":"SvelteKit's auth() handle helper (in lib/actions.ts, used by the handle hook) parses the response from the Auth.js backend and throws Error(data.message) for non-200 statuses. The backend's 'message' field is surfaced directly; a 200 with an empty payload returns null. Because auth() wraps every server request via handle, this error can surface on any page load when the auth core fails.","triggerScenarios":"Any server request flowing through the SvelteKit handle hook that triggers an internal auth fetch returning non-200 — missing AUTH_SECRET in .env, untrusted host in production (AUTH_TRUST_HOST unset behind a proxy), misconfigured auth route at src/routes/auth/[...auth], or a provider/adapter runtime error.","commonSituations":"Deployments to Vercel/Netlify/Node where AUTH_SECRET wasn't added to the platform's env settings; apps using a custom domain behind a reverse proxy causing UntrustedHost; renaming the /auth route without updating basePath.","solutions":["Read data.message in the thrown error to identify the underlying Auth.js core failure.","Set AUTH_SECRET in your deployment environment (SvelteKit reads .env only in dev).","Set AUTH_TRUST_HOST=true when running behind a proxy, or configure trustHost: true in the config.","Verify the auth catch-all route exists at src/routes/auth/[...auth]/+server.ts and matches the basePath."],"exampleFix":"// before\n// hooks.server.ts\nexport const handle = authHandle // throws on non-200 from auth core\n// after\n// Set env in deployment platform:\n// AUTH_SECRET=... AUTH_TRUST_HOST=true\nexport const handle = authHandle","handlingStrategy":"try-catch","validationCode":"// At server start (dev or prod):\nif (!process.env.AUTH_SECRET && !import.meta.env.DEV) {\n  console.warn(\"AUTH_SECRET is not set; auth() will fail in production\")\n}\n","typeGuard":"function isSession(data: unknown): data is { user?: { id?: string; email?: string } } & Record<string, unknown> {\n  return typeof data === \"object\" && data !== null && !((data as any) instanceof Error)\n}","tryCatchPattern":"try {\n  const session = await auth() // inside load/actions via locals\n} catch (err) {\n  console.error(\"Auth.js error (SvelteKit):\", (err as Error).message)\n  return { session: null }\n}","preventionTips":["Add AUTH_SECRET to your hosting platform's environment settings (Vercel/Netlify/Node).","Set AUTH_TRUST_HOST=true or trustHost: true when behind a reverse proxy.","Verify src/routes/auth/[...auth]/+server.ts exists and matches basePath.","Test the /auth/session endpoint after each deploy."],"tags":["sveltekit","session","http-response","framework-adapter"],"backgroundTag":"session-fetch-failed","analyzedSha":"a1a16a5a7780488c7449feece410033f445d0b31","analyzedAt":"2026-08-28T21:52:38.200Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}